<html>
<head>
<title> Bug 456041 -  Crash [@ nsCellMapColumnIterator::GetNextFrame] with contenteditable, generated content on table and double tbody</title>
<script>
//setTimeout(function() {window.location.reload();}, 500);
</script>
</head>
<body>
<span contenteditable="true"></span>

<style id="e">body table::after { content:"b";}</style>

<table>
<script>document.body.offsetHeight;</script>
<tbody></tbody>
<tbody></tbody>
</table>
</body>
</html>
